In updateProvidersWhenServiceRemoved of CredentialManagerService.java, there is a possible way to override settings across users due to a permissions bypass

In multiple locations, there is a possible tapjacking due to a logic error in the code

In multiple locations, there is a possible way to execute code in the launcher process due to an over-privileged shell user

In multiple functions of PackageInstallerService.java, there is a possible way to install unverified apps due to a missing permission check

In onCreate of DisableSupervisionActivity.kt, there is a possible way to delete supervision data due to a missing null check

In Bootloader, there is a possible permission bypass due to a missing permission check

In Load of LoadedArsc.cpp, there is a possible out of bounds write due to a heap buffer overflow